mirror/opencloud
1
0 Fork 0
mirror of https://github.com/opencloud-eu/opencloud.git synced 2026-11-08 21:43:00 -05:00
Code Issues Packages Projects Releases Wiki Activity
24,308 Commits 117 Branches 77 Tags
auditing-ng
Commit Graph
24308 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
micbar fdd3127e5e fix: add client addr to public link context 2026-11-06 15:08:35 +01:00
micbar fbdabfd645 docs: describe the client address with PROXY_CLIENT_IP_HEADER 2026-11-06 15:08:35 +01:00
micbar cdaf69fb41 fix(proxy): pass the user agent in the audit context 2026-11-06 15:08:35 +01:00
micbar 7c34d34d1d feat: pass the audit settings to the reva services 2026-11-06 15:08:35 +01:00
micbar 8801cd3dae feat(graph): audit user, group and role changes 2026-11-06 15:08:35 +01:00
micbar 7ada02461d feat(proxy): audit logins, public link access and backchannel logouts 2026-11-06 15:08:35 +01:00
micbar ca2973016a feat: read the audit request context in the HTTP services 2026-11-06 15:08:35 +01:00
micbar ed217078f6 feat(audit): write audit records from the audit stream 
# Conflicts:
#	go.mod
 2026-11-06 15:08:34 +01:00
Michael Barz 2edb3e1c7b Merge pull request #3914 from opencloud-eu/fix-healthchecks-2 
fix: filter health checks from the pod ip
 2026-11-06 15:07:10 +01:00
micbar 1eb3c738b1 fix: filter health checks from the pod ip 
The health check calls the address the server listens on. For 0.0.0.0
that is the IP of the pod, not the loopback address. Compare the peer
with the local address of the connection instead.
 2026-11-06 14:34:28 +01:00
Michael Barz 413082e97e Merge pull request #3908 from opencloud-eu/fix/healthcheck-access-log 
fix: keep the health checks out of the access log
 2026-11-06 09:56:55 +01:00
micbar f558acdfdb fix: keep the health checks out of the access log 2026-11-05 23:00:19 +01:00
Michael Barz 2eb513b16e Merge pull request #3906 from opencloud-eu/fix-tracing-global-propagator 
fix(tracing): set the global text map propagator
 2026-11-05 17:28:02 +01:00
dependabot[bot] 23399cdcff build(deps): bump github.com/prometheus/client_golang 
Bumps [github.com/prometheus/client_golang](https://github.com/prometheus/client_golang) from 1.24.1 to 1.25.0.
- [Release notes](https://github.com/prometheus/client_golang/releases)
- [Changelog](https://github.com/prometheus/client_golang/blob/v1.25.0/CHANGELOG.md)
- [Commits](https://github.com/prometheus/client_golang/compare/v1.24.1...v1.25.0)

---
updated-dependencies:
- dependency-name: github.com/prometheus/client_golang
  dependency-version: 1.25.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-05 17:20:56 +01:00
dependabot[bot] 5f349fa28a build(deps): bump github.com/nats-io/nats.go from 1.54.0 to 1.55.0 
Bumps [github.com/nats-io/nats.go](https://github.com/nats-io/nats.go) from 1.54.0 to 1.55.0.
- [Release notes](https://github.com/nats-io/nats.go/releases)
- [Commits](https://github.com/nats-io/nats.go/compare/v1.54.0...v1.55.0)

---
updated-dependencies:
- dependency-name: github.com/nats-io/nats.go
  dependency-version: 1.55.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-05 17:20:10 +01:00
dependabot[bot] 4234cc047e build(deps): bump github.com/kovidgoyal/imaging from 1.8.23 to 1.9.0 
Bumps [github.com/kovidgoyal/imaging](https://github.com/kovidgoyal/imaging) from 1.8.23 to 1.9.0.
- [Release notes](https://github.com/kovidgoyal/imaging/releases)
- [Commits](https://github.com/kovidgoyal/imaging/compare/v1.8.23...v1.9.0)

---
updated-dependencies:
- dependency-name: github.com/kovidgoyal/imaging
  dependency-version: 1.9.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-05 17:19:36 +01:00
Jörn Friedrich Dreyer dc7f4433a1 fix(tracing): set the global text map propagator 
The go-micro tracing wrappers and otelhttp inject and extract the trace
context with the global propagator. Nobody set it, so it stayed the
default no-op: no traceparent went over the wire and every go-micro
service (settings, policies, eventhistory, search) started a new trace
instead of joining the caller's.

GetTraceProvider now also sets the global propagator to the W3C
TraceContext and Baggage propagator we already use elsewhere.

fixes https://github.com/opencloud-eu/opencloud/issues/3856

Assisted-by: Claude Code:claude-opus-5-5
Signed-off-by: Jörn Friedrich Dreyer <jfd@butonic.de>
 2026-11-05 16:20:47 +01:00
dependabot[bot] 331855fe99 build(deps): bump google.golang.org/grpc from 1.84.0 to 1.85.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.84.0 to 1.85.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.84.0...v1.85.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.85.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-05 15:13:28 +01:00
Ryo Kusnadi 31722c878e fix(proxy): answer 403 instead of 500 when the role claim is missing 
With PROXY_ROLE_ASSIGNMENT_DRIVER=oidc, a token whose claims give no
OpenCloud role made the account resolver answer 500. Mark these claim
errors with userroles.ErrRoleClaim and answer 403 for them. Failures of
the settings or gateway service still answer 500.

Signed-off-by: Ryo Kusnadi <ryokusnadi@gmail.com>
 2026-11-04 15:29:30 +01:00
opencloudeu 79b2f33848 [tx] updated from transifex 2026-11-03 23:17:38 +00:00
dependabot[bot] 057e6ecd1f build(deps): bump github.com/KimMachineGun/automemlimit 
Bumps [github.com/KimMachineGun/automemlimit](https://github.com/KimMachineGun/automemlimit) from 1.0.0 to 1.0.1.
- [Release notes](https://github.com/KimMachineGun/automemlimit/releases)
- [Commits](https://github.com/KimMachineGun/automemlimit/compare/v1.0.0...v1.0.1)

---
updated-dependencies:
- dependency-name: github.com/KimMachineGun/automemlimit
  dependency-version: 1.0.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-03 18:50:35 +01:00
dependabot[bot] 4c63c900c0 build(deps): bump github.com/go-ldap/ldap/v3 from 3.4.14 to 3.4.15 
Bumps [github.com/go-ldap/ldap/v3](https://github.com/go-ldap/ldap) from 3.4.14 to 3.4.15.
- [Release notes](https://github.com/go-ldap/ldap/releases)
- [Commits](https://github.com/go-ldap/ldap/compare/v3.4.14...v3.4.15)

---
updated-dependencies:
- dependency-name: github.com/go-ldap/ldap/v3
  dependency-version: 3.4.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-03 18:36:26 +01:00
Andre Duffeck 5d0440378d Merge pull request #3884 from opencloud-eu/fix/webdav-generator-passthrough 
fix(webdav): stream announced types without a converter to the generator
 2026-11-03 14:45:04 +01:00
Dominik Schmidt e462b8ce27 fix(webdav): stream announced types without a converter to the generator 2026-11-03 11:34:16 +01:00
Jörn Friedrich Dreyer 8e83a0eebc Merge pull request #3464 from maki5/fix/upd_chi_real_ip 
fix(chore): upd deprecated chi RealIP middelware
 2026-11-03 11:05:58 +01:00
dependabot[bot] 9e8e3c161f build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace 
Bumps [go.opentelemetry.io/otel/exporters/stdout/stdouttrace](https://github.com/open-telemetry/opentelemetry-go) from 1.46.0 to 1.47.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.46.0...v1.47.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/exporters/stdout/stdouttrace
  dependency-version: 1.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-02 17:28:09 +01:00
dependabot[bot] 18a71463d4 build(deps): bump golang.org/x/image from 0.46.0 to 0.47.0 
Bumps [golang.org/x/image](https://github.com/golang/image) from 0.46.0 to 0.47.0.
- [Commits](https://github.com/golang/image/compare/v0.46.0...v0.47.0)

---
updated-dependencies:
- dependency-name: golang.org/x/image
  dependency-version: 0.47.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-02 17:06:51 +01:00
dependabot[bot] bc88811cae build(deps): bump golang.org/x/net from 0.61.0 to 0.62.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.61.0 to 0.62.0.
- [Commits](https://github.com/golang/net/compare/v0.61.0...v0.62.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.62.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-02 16:25:05 +01:00
Michael Barz 8cf11bf0ba Merge pull request #3855 from opencloud-eu/adr-auditing 
docs: add audit logging ADR
 2026-11-02 16:14:01 +01:00
Andre Duffeck e140d0250e Merge pull request #3853 from aduffeck/smtp-encryption-3844 
Point to the encryption setting when the SMTP server requires STARTTLS
 2026-11-02 11:17:19 +01:00
micbar b7bb4fbe8c fix: client address for clients in a private network and behind the proxy 2026-11-02 10:25:18 +01:00
Andre Duffeck 12d8edb6e7 Merge pull request #3858 from aduffeck/kql-quote-escaping 
Support doubled quotes in KQL values
 2026-11-02 08:56:40 +01:00
dependabot[bot] a2522d27bb build(deps): bump golang.org/x/net from 0.59.0 to 0.61.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.59.0 to 0.61.0.
- [Commits](https://github.com/golang/net/compare/v0.59.0...v0.61.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-version: 0.61.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-11-02 08:55:41 +01:00
opencloudeu 5ccce9c7e7 [tx] updated from transifex 2026-10-31 23:17:01 +00:00
Andre Duffeck 70fbc9fcb6 Merge pull request #3516 from opencloud-eu/fix/search-kql-path-normalization 
fix(search): normalize KQL path once
 2026-10-30 16:18:52 +01:00
Andre Duffeck 4118cd0b11 Merge pull request #3142 from opencloud-eu/fix/opensearch-bulk-item-errors 
fix(search): report rejected documents when indexing to OpenSearch
 2026-10-30 16:18:49 +01:00
micbar 4e7ebd4f8c fix: only trust forwarding headers from trusted reverse proxies 
chi's ClientIPFrom* header middlewares trust the header from anyone who can
  reach us. Pick the middleware per request instead: headers are only read
  when the peer is a trusted proxy, everyone else gets their network address.

  - PROXY_TRUSTED_PROXIES, defaults to loopback and private ranges
  - PROXY_CLIENT_IP_HEADER, defaults to X-Forwarded-For, e.g. CF-Connecting-IP
  - drop the strategy setting and xff_trusted_hops
  - pass the client address to the services in X-Forwarded-For instead of
    X-Client-Ip, reva reads it e.g. for OCM
  - same check in collaboration, traefik routes to it directly
  - OC_TRUSTED_PROXIES and OC_CLIENT_IP_HEADER set both services
  - the other services only drop RealIP, none of them reads the address

  Taken from #3864 and https://github.com/opencloud-eu/opencloud/pull/3464#issuecomment-6494799883

# Conflicts:
#	services/proxy/README.md
 2026-10-30 15:15:22 +01:00
Alex Ababii cf0f06e060 select correct chi middleware to get real IP based on config values 2026-10-30 15:13:55 +01:00
Alex Ababii 2230f93bfb upd test 2026-10-30 15:13:55 +01:00
Alex Ababii 850f1714a1 upd deprecated chi RealIP middelware 2026-10-30 15:13:54 +01:00
Michael Barz 1f45d322fa Merge pull request #3865 from opencloud-eu/addOssScannerDocker 
Add files for the Anthropic OSS-Scanner to run
 2026-10-30 15:11:42 +01:00
Dominik Schmidt e1f313be98 fix(search): keep a leading wildcard in place of the KQL path prefix 2026-10-30 12:56:41 +01:00
Dominik Schmidt ff482878d3 fix(search): keep pushing a batch after a rejected bulk, join the errors 2026-10-30 11:53:45 +01:00
Klaas Freitag 1248f08a8b Add files for the Anthropic OSS-Scanner to run 2026-10-30 11:25:59 +01:00
Dominik Schmidt 4a720c1a86 fix(search): resolve KQL path values like the scope path 2026-10-30 11:23:00 +01:00
Andre Duffeck 120750d8d5 Merge pull request #3476 from opencloud-eu/fix/graph-children-allowed-values 
fix(graph): expose allowedValues on driveItem children
 2026-10-30 11:11:32 +01:00
Andre Duffeck b8cc9c6eb5 Merge pull request #3496 from opencloud-eu/fix/search-geopoint-range 
fix(search): index resources with out-of-range coordinates without a geopoint
 2026-10-30 11:08:31 +01:00
Andre Duffeck e8bc4c8ced Merge pull request #3682 from opencloud-eu/fix/search-stale-facet-metadata 
perf(search): skip unchanged facet keys when storing metadata
 2026-10-30 10:33:18 +01:00
Dominik Schmidt 9a870295d9 perf(search): skip unchanged facet keys when storing metadata 2026-10-30 10:06:51 +01:00
André Duffeck ff742249ba Only read a KQL value as a date, number or boolean when it is the whole value 2026-10-30 08:54:05 +01:00